Update the CMS or application to a patched release on WordPress

Why it matters

Published security advisories cover the version of your CMS or application that the page shows, so it may be missing fixes. Hosts often back-port fixes without changing the version number, so treat this as a lead to check, not proof of a hole.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Back up the site, then open Dashboard, Updates and update WordPress core to the latest release. WordPress normally installs minor security releases automatically, so check that automatic updates are not switched off.
2. Update every plugin and theme afterwards, and remove those you do not use. Old plugins and themes are the most common way WordPress sites are attacked.
3. Run wp core version to see the installed version and wp core update to update it. If the page still reports an old version, clear page caches and your CDN, because the generator tag may be cached.

wp core version
wp core update
wp plugin update --all
wp theme update --all

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cms and framework advisories check
• Keep the software named in the finding up to date
• Patch the exploited vulnerability in your CMS or application